CVE-2026-103763 describes an information disclosure vulnerability in SiYuan note-taking software prior to version 3.8.5. The vulnerability arises from the getNotebookInfo endpoint, which permits read-only publish readers to retrieve metadata about documents that are excluded from publishing. This metadata includes document count, size, and modification timestamps. The vulnerability can be exploited by attackers, including anonymous visitors when no reader password is configured, by querying publish-visible notebooks to infer details about hidden documents.

The vulnerability exposes sensitive metadata about hidden documents to unauthorized actors. While it does not disclose document content, it reveals document counts, sizes, and modification timestamps, which may aid attackers in reconnaissance or privacy invasion. There is no indication of privilege escalation or direct content exposure. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.

A fixed version 3.8.5 or later is available that addresses this information disclosure issue. Users should upgrade to SiYuan version 3.8.5 or newer to remediate the vulnerability. Additionally, setting a reader password can prevent anonymous visitors from exploiting this flaw. No other mitigation is indicated by the vendor advisory.